Motors Car Dealership Classified Listings Plugin
Monthly
Unauthenticated time-based blind SQL injection in the Motors - Car Dealership & Classified Listings plugin for WordPress (all versions up to and including 1.4.109) lets remote attackers inject SQL through the 'stm_lat' and 'stm_lng' parameters and infer sensitive database contents one timed request at a time. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no account, privileges, or user interaction are needed - only that the plugin is installed and the geo-location endpoint that consumes these latitude/longitude parameters is reachable, which is the case in default configurations. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); exploitation is viable but inherently slow and noisy, since each extracted bit requires a distinct delayed response, so the practical risk is slow, stealthy exfiltration of database contents (hashes, user data, listing records) rather than rapid mass compromise.
Stored cross-site scripting in the StyleMix Motors - Car Dealership & Classified Listings plugin for WordPress (all versions through 1.4.112) lets unauthenticated attackers persist malicious JavaScript through the Comment Content and User Biographical Info fields, which then executes in the browser of any visitor or administrator who views the affected page. The scope-changed CVSS 3.1 score of 7.2 reflects that injected script runs in a security context different from the vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated injection path makes it broadly abusable against sites running this popular automotive/classifieds plugin.
Arbitrary file deletion in the Motors - Car Dealership & Classified Listings Plugin for WordPress (versions up to and including 1.4.107) allows authenticated users with subscriber-level access or higher to delete arbitrary files on the server by supplying a malicious filesystem path through the become-dealer logo upload flow. The flaw was reported by Wordfence and carries a CVSS of 8.1, but EPSS remains very low (0.05%) and CISA SSVC reports no observed exploitation, indicating risk is theoretical rather than active. No public exploit identified at time of analysis.
Stored cross-site scripting in the Motors - Car Dealership & Classified Listings WordPress plugin (versions up to and including 1.4.123) allows authenticated attackers with Subscriber-level access to inject arbitrary web scripts via the 'stm_f_s' parameter. The CSRF nonce protecting the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, so any logged-in user can retrieve it, removing the usual barrier to exploitation. This is a moderate-risk issue (CVSS 6.4) and no public exploit has been identified at the time of analysis.
Authorization bypass in the Motors - Car Dealership & Classified Listings Plugin for WordPress allows authenticated subscriber-level users to arbitrarily mark any other user's vehicle listing as sold by replaying a harvested nonce against a victim's post ID. All plugin versions up to and including 1.4.111 are affected. An attacker exploiting this flaw can silently deface competitor or victim listings with a site-wide 'Sold' badge while also stripping the `special_car` featured post meta, causing business harm on dealership or classifieds sites. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Authenticated users with Subscriber-level access can bypass PayPal payment verification in the Motors - Car Dealership & Classified Listings WordPress plugin (versions up to 1.4.103) by directly modifying their stm_payment_status user meta field to 'completed', gaining access to paid Dealer membership features without completing any transaction. The vulnerability exists in the stm_save_user_extra_fields() function, which fails to validate permission for sensitive meta field modifications during profile updates. While CVSS 4.3 reflects low severity, the integrity impact is direct-payment systems are completely circumvented for any authenticated user.
Unauthenticated time-based blind SQL injection in the Motors - Car Dealership & Classified Listings plugin for WordPress (all versions up to and including 1.4.109) lets remote attackers inject SQL through the 'stm_lat' and 'stm_lng' parameters and infer sensitive database contents one timed request at a time. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no account, privileges, or user interaction are needed - only that the plugin is installed and the geo-location endpoint that consumes these latitude/longitude parameters is reachable, which is the case in default configurations. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); exploitation is viable but inherently slow and noisy, since each extracted bit requires a distinct delayed response, so the practical risk is slow, stealthy exfiltration of database contents (hashes, user data, listing records) rather than rapid mass compromise.
Stored cross-site scripting in the StyleMix Motors - Car Dealership & Classified Listings plugin for WordPress (all versions through 1.4.112) lets unauthenticated attackers persist malicious JavaScript through the Comment Content and User Biographical Info fields, which then executes in the browser of any visitor or administrator who views the affected page. The scope-changed CVSS 3.1 score of 7.2 reflects that injected script runs in a security context different from the vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated injection path makes it broadly abusable against sites running this popular automotive/classifieds plugin.
Arbitrary file deletion in the Motors - Car Dealership & Classified Listings Plugin for WordPress (versions up to and including 1.4.107) allows authenticated users with subscriber-level access or higher to delete arbitrary files on the server by supplying a malicious filesystem path through the become-dealer logo upload flow. The flaw was reported by Wordfence and carries a CVSS of 8.1, but EPSS remains very low (0.05%) and CISA SSVC reports no observed exploitation, indicating risk is theoretical rather than active. No public exploit identified at time of analysis.
Stored cross-site scripting in the Motors - Car Dealership & Classified Listings WordPress plugin (versions up to and including 1.4.123) allows authenticated attackers with Subscriber-level access to inject arbitrary web scripts via the 'stm_f_s' parameter. The CSRF nonce protecting the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, so any logged-in user can retrieve it, removing the usual barrier to exploitation. This is a moderate-risk issue (CVSS 6.4) and no public exploit has been identified at the time of analysis.
Authorization bypass in the Motors - Car Dealership & Classified Listings Plugin for WordPress allows authenticated subscriber-level users to arbitrarily mark any other user's vehicle listing as sold by replaying a harvested nonce against a victim's post ID. All plugin versions up to and including 1.4.111 are affected. An attacker exploiting this flaw can silently deface competitor or victim listings with a site-wide 'Sold' badge while also stripping the `special_car` featured post meta, causing business harm on dealership or classifieds sites. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Authenticated users with Subscriber-level access can bypass PayPal payment verification in the Motors - Car Dealership & Classified Listings WordPress plugin (versions up to 1.4.103) by directly modifying their stm_payment_status user meta field to 'completed', gaining access to paid Dealer membership features without completing any transaction. The vulnerability exists in the stm_save_user_extra_fields() function, which fails to validate permission for sensitive meta field modifications during profile updates. While CVSS 4.3 reflects low severity, the integrity impact is direct-payment systems are completely circumvented for any authenticated user.